{
  "name": "BlindEagle Targets Colombian Government Agency with Caminho and DCRAT",
  "slug": "blindeagle-targets-colombian-government-agency-with-caminho-and-dcrat",
  "description": "A spear phishing campaign targeting a Colombian government agency under the Ministry of Commerce, Industry and Tourism was discovered in September 2025. The attack, attributed to BlindEagle, utilized a compromised email account within the organization to bypass security controls. The campaign employed a sophisticated multi-layer attack chain, including a fake web portal, nested JavaScript and PowerShell scripts, steganography, and the deployment of Caminho as a downloader for DCRAT. The attack leveraged legal-themed lures, in-memory execution, and abuse of legitimate services like Discord. BlindEagle's evolution in tactics and use of new tools like Caminho demonstrates their ongoing threat to Colombian institutions.",
  "published": "2025-12-17T01:49:03+00:00",
  "created_at": "2025-12-17T01:49:03+00:00",
  "modified_at": "2025-12-21T18:33:01+00:00",
  "created_at_opencti": "2025-12-17T01:49:03+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-12-17",
    "dcrat",
    "discord",
    "powershell",
    "spear-phishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "103.20.102.130"
      },
      {
        "id": "",
        "name": "103.236.70.158"
      },
      {
        "id": "",
        "name": "181.235.3.119"
      },
      {
        "id": "",
        "name": "203.104.42.92"
      },
      {
        "id": "",
        "name": "191.93.118.254"
      },
      {
        "id": "",
        "name": "181.206.158.190"
      },
      {
        "id": "",
        "name": "179.13.11.235"
      },
      {
        "id": "",
        "name": "185.18.222.5"
      },
      {
        "id": "",
        "name": "74.124.24.240"
      },
      {
        "id": "",
        "name": "191.91.178.101"
      },
      {
        "id": "",
        "name": "103.20.102.151"
      },
      {
        "id": "",
        "name": "181.131.217.135"
      },
      {
        "id": "",
        "name": "179.13.4.196"
      },
      {
        "id": "",
        "name": "178.16.54.45"
      },
      {
        "id": "",
        "name": "103.186.108.212"
      },
      {
        "id": "",
        "name": "45.153.34.67"
      },
      {
        "id": "",
        "name": "3ef2cf8f65a9a6f4955ecd0292af0cd68e65864907d07543c416ab28a2acfa6d"
      },
      {
        "id": "",
        "name": "08a5d0d8ec398acc707bb26cb3d8ee2187f8c33a3cbdee641262cfc3aed1e91d"
      },
      {
        "id": "",
        "name": "e7666af17732e9a3954f6308bc52866b937ac67099faa212518d5592baca5d44"
      },
      {
        "id": "",
        "name": "d0fe6555bc72a7a45a836ea137850e6e687998eb1c4465b8ad1fb6119ff882ab"
      },
      {
        "id": "",
        "name": "03548c9fad49820c52ff497f90232f68e044958027f330c2c51c80f545944fc1"
      },
      {
        "id": "",
        "name": "d139bfe642f3080b461677f55768fac1ae1344e529a57732cc740b23e104bff0"
      },
      {
        "id": "",
        "name": "8f3dc1649150961e2bac40d8dabe5be160306bcaaa69ebe040d8d6e634987829"
      },
      {
        "id": "",
        "name": "c208d8d0493c60f14172acb4549dcb394d2b92d30bcae4880e66df3c3a7100e4"
      }
    ],
    "malware": [
      {
        "id": "eb832bdd-0dcb-4866-8f63-4dd299798562",
        "name": "DCRAT",
        "slug": "dcrat"
      },
      {
        "id": "0ddd259b-9dec-4359-b142-fc734c869701",
        "name": "Caminho",
        "slug": "caminho"
      }
    ],
    "intrusion_sets": [
      {
        "id": "43def43d-6a51-4eda-ac8f-7217a37c7e87",
        "name": "BlindEagle",
        "slug": "blindeagle"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "741a926d-4157-412c-9296-f701c8dbd56d",
        "name": "T1027.003"
      },
      {
        "id": "415f839d-5ae7-41fb-92c3-090f3226055d",
        "name": "T1586.002"
      },
      {
        "id": "ef72da1d-2eaa-4d94-8913-06978609cfb4",
        "name": "T1608.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "88fa397b-4cc9-42c0-b52d-4108f9630529",
        "name": "T1095"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "2ccc4626-0e86-4148-a5a8-2aa270e22dbd",
        "name": "T1588.001"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Colombia"
      },
      {
        "id": "",
        "name": "Government and administrations"
      },
      {
        "id": "",
        "name": "startmenuexperiencehost.ydns.eu"
      }
    ]
  },
  "external_refs": [
    "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat",
    "https://otx.alienvault.com/pulse/69421a1f3d6e9eac9a0ce057"
  ]
}